Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →lingxling/smtp-penetration-testing
Conduct comprehensive security assessments of SMTP (Simple Mail Transfer Protocol) servers to identify vulnerabilities including open relays, user enumeration, weak authentication, and misconfiguration.
Passed 19 of 22 test cases with the skill, and 19 of 22 without it.
1 fixed18 passed either way2 still failing1 broke
Tokens, turns and time describe resource use, not a dollar price.
This benchmark measured an earlier version of the skill.
A test case the skill fixed. Same model, same prompt, with and without the skill.
Can you evaluate our gateway mail server at 10.0.4.15 to see if user account harvesting is possible? Run user discovery testing against the target and provide a deliverable detailing discovered valid email addresses, command exposure risks, and guidance to prevent enumeration.
| Checked | Without skill | With skill |
|---|---|---|
| Evaluates user discovery using SMTP enumeration | Missed | Passed |
| Details command exposure risks for user verification commands | Missed | Passed |
| Provides guidance to disable user verification commands | Missed | Passed |
The instructions your model reads when the skill loads.
⚠️ AUTHORIZED USE ONLY This skill is for educational purposes or authorized security assessments only. You must have explicit, written permission from the system owner before using this tool. Misuse of this tool is illegal and strictly prohibited.
Mandatory confirmation gate Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:
- Ask the user to state the exact target URL, IP, account, or resource.
- Ask the user to confirm written authorization and the permitted scope.
- Show the exact command(s) and explain their expected effect.
- Wait for explicit confirmation in the current conversation.
Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.
AUTHORIZED USE ONLY: Use this skill only for authorized security assessments, defensive validation, or controlled educational environments.
Read the detailed guide before executing this skill. It retains the complete procedure and reference material. Treat its safety, prerequisites, and validation requirements as mandatory. For focused work, load the relevant sections; for end-to-end work, read the guide completely.
# Nmap with SMTP scripts
sudo apt-get install nmap
# Netcat
sudo apt-get install netcat
# Hydra for brute force
sudo apt-get install hydra
# SMTP user enumeration tool
sudo apt-get install smtp-user-enum
# Metasploit Framework
msfconsole
test cases passed, vs 19 / 22 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.